analytics-api role

I'm assuming the `release` branch is the correct one to make a PR into.

Most of this is just backported from the HEAD of edx/configuration

@jrbl @stvstnfrd 
This is super picky, but I like defining local_dir relative to secure_dir so I can see at a glance that everything's in the same place.